I browse to my splunk host from my local PC, log in, then click 'Splunk Apps'.
I see 'Browse More Apps'.
Under that, "Error connecting: Winsock error 10054".
Ultimately, I need to install the Palo Alto Firewall App. (Then learn how to make that work.)
I am having the exact same problem.. I doubt I have access to the internet in Splunk because my instance is running locally. I'm not sure I follow when you say go to apps > install apps from file. Can someone please go into a bit more detail?
Thanks in advance!
I figured out my issue. First, the server and my admin logon do not have internet access.
From my desktop, I can browse to the Splunk console.
It turns out the network I'm in has an odd problem. From my desktop, I can get out where I need to. But, if I RDP to any devices using my admin logon (which is restricted) my desktop somehow inherits that restriction and I can't get out at all. After I disconnect that restrictive RDP session and wait a few minutes; all is well. I was able to install the Palo Alto App and Plug In.
Now, to figure out how to configure that.
does your splunk server has connectivity to the outside world? (internet)
you can try and download the app to your laptop and then go to apps -> install apps from file and pick the download
or you can untar and manually copy to the .../etc/apps/ directory.
for the PAN app youll need the TA for PAN as well
hope it helps